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■ Provides a framework for reporting Corporate Compliance Program activities to the 
Board of Directors through the Audit & Compliance Committee and Chief Executive 
Officer 

■ Establishes formal reporting requirements through written reports and meeting minutes 
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PURPOSE 

Cook County Health (collectively, “CCH”) is committed to high ethical and moral standards, as well as ethical and 
legal business conduct at all levels of the organization. The Office of Corporate Compliance functions to prevent and 
detect violations of applicable laws and regulations. Therefore, it is the policy of CCH to have in place a system for 
reporting Corporate Compliance activities to the CCH Board of Directors (Board) through the Audit & Compliance 
Committee and the CCH Chief Executive Officer (CEO). 

AFFECTED AREAS 

This policy applies to the Office of Corporate Compliance, CCH Board of Directors, and the CCH CEO. 

POLICY 

A. The Board has an obligation with respect to the duty of care, which arises in two distinct contexts: 

1. The decision-making function - application of duty of care principles to a specific decision made by 
the Board or action performed by the Board; and 

2. The oversight function - application of the duty of care principles in relation to the Board’s general 
activity with respect to business operations (e.g. exercising reasonable care to assure that CCH senior 
leadership carry out their management responsibilities and comply with the law). 

B. The Board must act in good faith in the exercise of its oversight responsibility for the entire organization, 
including oversight of the CCH Corporate Compliance Program. With these obligations in mind and 
considering the ongoing expansion of health care regulatory enforcement activities, monitoring the Corporate 
Compliance Program is critical. This includes making inquiries of the Corporate Compliance Program to ensure 
that: 

1. There are Corporate Compliance Program information and reporting systems that exist and are 
operational; and 

2. The Board has adequate and appropriate information related to the Corporate Compliance Program in 
order to fulfil its oversight responsibilities. 

C. The Board has the responsibility to make a good faith effort to support and monitor the Corporate Compliance 
Program. In turn. Corporate Compliance must provide the Board with information as it relates to compliance risk 
and organizational impact to support the Board’s duty of care responsibilities. 

D. CCH has the responsibility to establish guidelines for reporting compliance violations to the Board. The Board 
should understand the process used by operational leadership for evaluating and responding to violations 
reported and substantiated, in relation to CCH’s policies, as well as applicable federal and state laws. 
Information reported to the Board should be sufficient for the Board to evaluate the appropriateness of the 
organization’s response. 

E. The Chief Compliance & Privacy Officer or designee shall maintain communication between the Board and its 
committees, independent auditors, and senior management. The Chief Compliance & Privacy Officer shall 
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address and review matters concerning or relating to the Corporate Compliance Program and making the 

appropriate parties aware of issues as deemed necessary or required by CCH policy. 

PROCEDURE 

A. The Chief Compliance & Privacy Officer, or their designee, will provide a formal report on the status of the 
CCH Corporate Compliance Program to the Board through the Audit & Compliance Committee and the 
CEO. The Chief Compliance & Privacy Officer or designee will provide such reports on a regular basis, and 
as needed between regularly scheduled meetings. Issues of high compliance risk and high organizational 
impact will be reported at the time Corporate Compliance has knowledge of the incident. 

B. The Chief Compliance & Privacy Officer or designee will ensure that Board-level reporting addresses both 
reactive issues and proactive Compliance Program activities. Reporting shall include, at a minimum, 
information regarding: 

1. Valid, substantiated high compliance risk and high organizational impact concerns along with plans 
for remediation; 

2. The status of ongoing investigations; 

3. Trends and patterns of compliance-related issues; 

4. Corporate Compliance Program statistics (e.g. hot-line statistics, audit results, etc.); 

5. Plans for ongoing education and focused education; 

6. Corporate Compliance Program intervention and corrective actions; and 

7. Corporate Compliance Program work plan(s). 

C. Audit & Compliance Committee of the Board meeting minutes should include the report of Corporate 
Compliance and any discussions regarding compliance issues. 

D. The minutes of the Audit & Compliance Committee shall be reviewed by the Board as a whole. 

E. The Chief Compliance & Privacy Officer or designee must be available to the full Board to respond to any 
inquiries and questions related to Audit & Compliance Committee reporting and actions (e.g. policy 
approvals, approval of corrective action plans, audit matters, etc.). 

F. The Chief Compliance & Privacy Officer or designee will be available to meet with independent Board 
members in executive session. 

POLICY REVIEW/UPDATE SCHEDULE 

Every three (3) years, or more often as appropriate. 

REGULATORY REFERENCES 

Corporate Responsibility and Corporate Compliance: A Resource for Health Care Boards of Directors by the Office of 

Inspector General of the U.S. Department of Health and Human Services and the American Health Lawyers 

Association 

Department of Health and Human Services, Office of Inspector General: Compliance Resources 

Patient Protection and Affordable Care Act (PPACA), Section 6401 

State of Illinois Contract between the Department of Healthcare and Family Services and County of Cook, a Body 

Politic and Corporate by and through its Cook County Health and Hospitals System for Furnishing Health Services by 

a County Managed Care Community Network, 2018-24-201 

United States Sentencing Commission Guidelines: 2015 Chapter 8 — Sentencing of Organizations 
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POLICY REFERENCES 

CCH Code of Ethics 

CCH Corporate Compliance Program Policy 
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POLICY LEAD 

Cathy Bodnar, MS, RN, CHC 

Chief Compliance & Privacy Officer 

Cook County Health 

REVIEWER 

John Jay Shannon, MD 

Chief Executive Officer 

APPROVAL PARTY 

CCH Audit & Compliance Committee 

Approved on [INSERT DATE] 

REVIEW HISTORY: 

Written: 12/03/2010 

Approval: 01/18/201 r 


■' Initial approval at the Audit and Compliance Committee of the Board of Directors of Cook County Health and 
Hospitals System on Tuesday, January 18, 2011 at John H. Stroger, Jr. Hospital of Cook County, 1900 W. Harrison 
Street, in the fifth floor conference room, Chicago, Illinois. 

Updated: 05/31/2019 

Approval: 










